CVE-2023-22515

.appsec-tests/CVE-2023-22515/CVE-2023-22515.yaml

@@ -0,0 +1,28 @@
+id: CVE-2023-22515
+info:
+  name: Atlassian Confluence - Privilege Escalation
+  severity: critical
+  author: crowdsec
+  description: |
+    Atlassian Confluence Data Center and Server contains a privilege escalation vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
+variables:
+  username: "{{rand_base(10)}}"
+  password: "{{rand_base(10)}}"
+  email: "{{username}}@{{password}}"
+
+http:
+  - raw:
+      - |
+        @timeout:20s
+        POST /setup/setupadministrator.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        X-Atlassian-Token: no-check
+
+        username={{to_lower(username)}}&fullName=admin&email={{email}}.com&password={{password}}&confirm={{password}}&setup-next-button=Next
+    cookie-reuse: true
+    redirects: true
+    matchers:
+      - type: status
+        status:
+          - 403

.appsec-tests/CVE-2023-22515/config.yaml

@@ -0,0 +1,3 @@
+appsec-rules:
+- ./appsec-rules/crowdsecurity/vpatch-CVE-2023-22515.yaml
+nuclei_template: CVE-2023-22515.yaml

appsec-rules/crowdsecurity/vpatch-CVE-2023-22515.yaml

@@ -0,0 +1,37 @@
+name: crowdsecurity/vpatch-CVE-2023-22515
+description: "Detect CVE-2023-22515 exploits "
+rules:
+  - and:
+    - zones:
+      - URI
+      transform:
+      - lowercase
+      match:
+        type: endsWith
+        value: /setup/setupadministrator.action
+    - zones:
+      - METHOD
+      match:
+        type: equal
+        value: POST
+    - zones:
+      - HEADERS
+      variables:
+       - x-atlassian-token
+      transform:
+      - lowercase
+      match:
+        type: equal
+        value: "no-check"
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: "http:exploit"
+  label: "Atlassian Confluence Privesc (CVE-2023-22515)"
+  classification:
+   - cve.CVE-2023-22515
+   - attack.T1595
+   - attack.T1190
+   - cwe.CWE-1390